Index
Get the latest news right in your inbox
Two-step authentication, two-step verification or 2FA has become very important in recent years. Not only linked to account security but also because regulations in many markets have begun to require companies to implement this system.
Similarly, companies in sectors in which its implementation is not mandatory to have begun to offer this possibility and have even promoted incentive campaigns for their users to activate two-step verification. This is practically a must in any risk management strategy for companies and businesses with a digital presence today.
As an organization or business, we must understand the importance of this method in the platforms we offer to our customers and users, whether we are required to do so by law or not.
What is two-step authentication?
Two-step authentication is an identity verification system designed to grant users secure access to their accounts, products and services or customer management platforms. That is, a series of identity checks that ensure that the person requesting access to a user account is its rightful owner.
The distinguishing feature of the two-step authentication model is that it uses two factors instead of a single one. This adds an extra layer of security by forcing the applicant to provide two different pieces of evidence to confirm that they are who they say they are.
Also known as 2FA (Two Factor Authentication), two-step verification is a much more secure method than just using the account's email address along with a simple alphanumeric password. In addition, a second step is added to be identified in a service that guarantees more exhaustive controls.
This prevents users with fraudulent intentions from impersonating customers by accessing their accounts and making transactions on their behalf. This not only puts consumers at risk but the entire organization, which could face millions in penalties. It is very common for easily vulnerable passwords to be chosen and used by hackers or other criminals. With two-step authentication, we break this with two-factor authentication that has not been obtained.
This second action after entering the username and password is much more difficult to breach, especially if inherent authentication factors are involved. Thus, two-step identification must use all the technology at its disposal to ensure access, login and authentication processes that are completely impassable.
The best two-step authentication systems are able to use authentication factors depending on the device from which the user is accessing and detect suspicious behavior. In addition to this, there are dozens of controls that platforms are implementing to take security to its highest level.
Multi-factor verification
Before delving into the authentication process, let's take a brief look at the steps that precede it: User onboarding and Know Your Customer. Registering customer information in the company's database must be done according to very specific technical and legal standards.
In many industries, it is not enough just to process information in accordance with privacy regulations, but also to establish exhaustive identity verification controls to corroborate that the user is who he or she claims to be. This is the basis for any subsequent interaction to be carried out under an environment of guarantees, trust and full legal support.
In digital onboarding, we see how the steps prior to the first authentication are done in an agile and automated way, with the least possible effort by the user and acquiring the data through OCR, for example. Here comes into play the verification of the identity documentation of users, anti-fraud controls that prevent any attempt of impersonation or the signing of documentation and acceptance of terms of use.
During this registration, you proceed to create the credentials with which the user will later access your products and services or the customer area. This is where authentication comes into play. The method of creating these credentials is decisive for subsequent two-step authentication. Using the user characteristics extracted by the technology that accompanies the best Know Your Customer (KYC) processes will ensure that subsequent authentications are technically and regulatory supported at the highest level.
Types of authentication factors
As we have seen, two-step verification consists of the use of two authentication factors to corroborate that the person trying to access a customer or user account is its legitimate owner. Two-factor authentication strategies use two factors to protect this access.
The following is an overview of the different types of authentication that can be selected in combination for any 2FA or MFA model:
- Alphanumerics that must be remembered: These are characterized by the use of letters, numbers and symbols. From 4- or 6-digit codes to the usual passwords, there are many types of passwords that can be set.
- Social login: This is a factor-based authentication method that picks up another platform with its own verification system, also sometimes in two steps. It is useful but must be accompanied by a second control.
- Physical item in possession: It can be a card with an NFC chip, a mobile device or a pendrive.
- A physical element that is inherently itself: That is, biometric authentication factors such as face, voice, iris or fingerprint.
- Time and behavior: These are those that have as a reference the user's behavior, the way and the time in which the user develops a series of interactions with the platform.
- Of place: a system of location or controls to identify that the user is in a certain place to which only he has access. However, these are very uncommon like the previous ones.
And, to the question "what are the best authentication factors?" there is a resounding answer that both experts and users share: the inherent ones. facial biometrics and face recognition systems have proven to be the preferred option for users and the most secure factor since it cannot be lost, it cannot be subtracted and today the technology that makes it possible is impassable.
Two-factor authentication
When we talk about two-factor authentication, we are referring to the second of a series of several factors required in an identity verification operation. How to choose the right order? Well, it might seem that the most logical thing to do would be to start with a less secure factor and increase the difficulty as the first ones are passed. However, the best recommendation is to be unpredictable.
The choice of two-factor authentication should be dynamic so that it does not always follow a specific pattern. This will mislead those who intend to commit identity fraud and cause them to give up trying to access a customer account that does not belong to them.
On the other hand, companies are launching campaigns to encourage their users to enable two-factor authentication (2FA), either through third-party apps, the use of SMS or OTPs sent via email. This is important for those companies and organizations that already have a huge database of users who signed up to the platform before two-step verification became the norm. However, it's a lot easier than it sounds:
Advantages, disadvantages and 2FA activation
Today, there are holistic SaaS - pay-per-use - platforms that cover all user interactions in their customer journey so that companies do not have to initiate complex projects to transform their operations and processes in a costly way. Today, two-factor authentication systems that cross-reference proof of identity with the data offered at registration can be incorporated in days.
The advantages of two-step authentication come in the form of apps for users and applications for businesses that make it really easy to make their accounts and systems impassable to hackers and online criminals. When we think of drawbacks, it comes to mind whether conversion rates and the number of transactions will be reduced by requiring more effort from the customer.
However, there are hardly any businesses that - either because they are forced by regulation or because they want to be secure according to current standards - have not already integrated access and account screening systems based on two-step verification models. Users have no problem activating strong authentication and a good system designed with UX/UI best practices will not generate any friction.
PSD2 and SCA: Strong Client Authentication Secure Client Authentication (SCA) and other standards
Two-step authentication has become increasingly important not only because of the increase in cyber attacks due to the explosion of remote and digital services and products. The approval of national, international and regional regulations that oblige companies to have more exhaustive control over the use they make of their clients' data and the protection of their systems to avoid risks has been decisive for its expansion and, above all, for its standardization.
The European directive PSD2 (Second Payment Services Directive) has completely transformed the banking and financial sector, especially the FinTech area. Its approval forced all companies to standardize their access and authentication methods in order for users to carry out transactions through their digital portals.
This regulation created the SCA - Strong Customer Authentication - concept, which aims to promote security in both financial institutions and TPPs. Although focused on online shopping, the SCA has taken two-step identification to all industries and areas, setting standards for the proper functioning and performance of multi-factor authentication strategies.
In conclusion, businesses should not wait for these types of standards to reach their markets and sectors to incorporate authentication systems into their platforms. Security is crucial for any business and not only is it an additional option, but not having these controls in place will scare away a large part of potential customers because they feel that they are operating with a company that does not take care of their data or the products and services they have purchased and contracted, making them feel insecure.
In any risk management strategy, IT security is a priority today. Thousands of companies every day suffer attacks of impersonation of the identity of their customers, putting at risk not only these, but the company to be responsible for this. Sometimes, these attacks have caused businesses to stop their activity, and they have had to face sanctions or lawsuits from the affected users.
